A security policy is a set of explicit regulations that people with access to an organization’s technology, assets, and resources must follow. The primary goal of a security policy should be to notify employees and users of their legal obligations to secure data, information, and technology assets on and off the premises. The process through which these expectations are to be met should be defined in the policy. Second, a security policy should establish a baseline for acquiring, configuring, and auditing network and computer systems for policy compliance. As a result, a consistent security policy should be implemented throughout the business, with detailed recommendations for staff to utilise as a reference for their daily tasks. The major goal is to provide you a thorough grasp of how to apply network security policies to protocols, communications, and devices in a generic and consistent way. The essay will also concentrate on some of the best practises and approaches for developing and implementing an effective network security policy in the form of policies rather than actual execution. Before we get into the key points of discussion, let’s have a look at why we need a network security strategy in the first place. Why create a Network Security Policy The following are some of the advantages of creating a well-structured policy:
Provides a roadmap for security purchases and deployments. Steps to take in the event of a security breach or incident are detailed. Defines which technologies to utilise, as well as which can and cannot be introduced to the network. Creates a foundation for a legally enforceable line of action. Defines who is responsible for sanctioning, implementing, funding, supporting, monitoring, and auditing policies at all levels of the organisation. Serves as a starting point for the next step in network security growth.
Network Security Policy
Because practically any security system can be broken or subverted, there is no single definitive mechanism for completely safeguarding a network. Intrusions might come from the outside or from within. As a result, having multiple levels of security barriers may be the most effective strategy to safeguard a network system. As a result, an attacker will have to get across multiple systems in order to obtain access to the target’s essential assets. The first step in enforcing a security policy is to identify the policy that you want to enforce. Security measures are in place to limit personnel’s day-to-day activities. In some circumstances, the measures are found to be “very” restrictive, leading to the desire to tighten security restrictions. These network measures are in place to simplify employees’ activities under normal circumstances and, as a result, must be properly specified. They provide instructions on how to respond in the event of an irregularity. The section below shows how each concept of network security measures should be implemented to secure systems and other valuable information in this setting.
Device Security
You’ll have to prioritise distinct network segments based on their security requirements when designing your network’s security infrastructure. For example, certain servers will be open to the public, while others will be restricted to a specific group of personnel. As a result, in order to establish adequate security for various subdivisions and categories, you will erect barriers in the form of Private networks, Semi-private networks, and Public networks that can only be traversed by specific types of traffic. Devices that manage the in-flow and out-flow of packets into distinct network segments, such as switches, gateways, bridges, and routers, can create such limits from different network segments. Every communication and monitoring device in the network system must be configured correctly in accordance with the policy requirements. Access should be granted based on the privileges that have been assigned to the user. Furthermore, the deployed device’s inbuilt software or operating systems must be current. In addition to the aforementioned rules, the following procedures should be considered in the context of device security:
Patches and security updates should be installed on a regular basis as soon as they are released by vendors. All services that aren’t used should be turned off. Each employee should be given a non-disclosure agreement (NDA) that prohibits them from discussing the details of devices put within the perimeter. To regulate UDP and TCP traffic, the company needs maintain an ACL.
Internet Access
All hose that automatically filters all websites regarded as improper, especially those related to social media platforms, are policies pertinent to internet access. The user’s ability to access the internet should be determined by the nature of his or her job. The internet and network are synonymous in a company since they connect critical assets such as account sections, servers, and so on. Access to the internet should be carefully checked and filtered before being used.
VPN Policy
VPNs are supposed to be used only on company-owned computers, as they provide a mechanism to safeguard data as it travels through an insecure network. Every remote connection to the corporate network should be made using a standard operating system and a VPN that has been approved by the company. To prevent unauthorised access, remote access to company computers from home over the internet must be banned. To provide suitable protection for anyone attempting to access businesses’ computers remotely, L2TP with IPSec should be used. Client traffic should also be filtered by firewalls.
Port Communication Policy
Even when not in use, only vital services such as HTTP should be remained available. Otherwise, for superfluous services, all other ports, whether outward or inbound, should be rigorously prohibited. The presence of multiple unnecessary ports open raises the likelihood of a system breach. As a result, ports that are directly connected to the internet should be limited to inbound connections or use only allowed communication services.
Wireless LAN Policy
To prevent probable wireless network misuse, an effective network policy should include instructions on correct user authentication, a method for wireless LAN anomaly detection, and a technique for suitable WEP substitution. 802.11 security mechanisms such as CCMP, TKIP, and others should be used for encryption. The following is a list of some of the suspicious occurrences that should always be considered for intrusion detection over a wireless network:
Randomly changing MAC address Multiple erroneous SSIDs on a closed network Beacon frames received from an uninvited access point Frames with double MAC addresses
Policy for Remote Connections
Data breaches are becoming increasingly common as more companies develop network connections amongst their staff to boost productivity. In most cases, an attacker hijacks a session by blocking the remote user and utilising their credentials to gain access to the Company’s network as if they were a remote host on a network. Mismanagement of distant users’ personal information can potentially lead to system exploitation. Only authorised users should have direct access to a company’s crucial server, while others should have access only through the SSH utility or remote login.
Firewall Rules Policy
When a user connects to an insecure open network, they allow potential attackers to gain access to the system. Firewalls at the connection point end may be required in such instances to protect communication facilities and private networks. While deploying a firewall to various regions of the network, keep the following guidelines in mind:
A proxy firewall between the remote user and the dedicated server hides the server’s identity for dedicated server access. A packet-filtering firewall should be installed if traffic filtering is required based on destination and source port/IP addresses, as this improves transmission speed. When transmission speed is not critical, however, state table inspection may be adequate because it dynamically checks the connection and forwards the packet. When an organization’s internal network requires additional security, NAT should be used in conjunction with the firewall. Finally, if you need a higher level of regulation than simply blocking communication between an IP address and your server, you can use IP packet filtering.
Intrusion Policy
IDs should be stored in the extreme line of defence for anomaly monitoring and unauthorised access detection, as antivirus and firewall safeguards are insufficient. Security personnel or risk managers must also monitor the system on a frequent basis for any unusual activities. Use Advance Antivirus with inbuilt IPS/IDS to protect against elevated privileges, changed permissions, incorrect auditing rights, inactive users, registry changes, and more. Because of performance reasons, IDS software is configured through the OS whereas intercepting IDS software is deployed as a hardware application.
Proxy Server Policy
Proxy servers are often located between a user and a server and are used for both defensive and offensive purposes. When setting up a proxy server, make sure you follow the instructions below.
A logging feature should be available to all services. Outside connections should not be accepted by a proxy. The proxy should be running on the latest software and fixes.
Policy on Secure Communication
SYN flooding, session hijacking, spoofing, and sniffing are examples of attacks that can occur when data is transmitted in an unencrypted manner over various routes on the network, such as routers and switches. You won’t be able to fully manage the device via which data is transmitted. At the very least, you can protect the data itself from a breach or the data transmission channel from being data accessible to a certain extent. To defend against such attacks, use ciphering techniques like SSH, IPsec, SSL, and TLS, which may virtual encrypt many types of communication including HTTP, IMAP, POP, FTP, and POP3. Because SSL packets can easily pass through NAT servers, configured firewalls, and any device on the network as long as the relevant ports are left open on the device, this is the case. If you need to communicate data that is important to your company, you must take special steps. Some of the initiatives are listed below:
Ascertain that MITM attacks do not tamper with data in transit. Ensure that the conveyance channel is not breached by any unauthorised individuals between the source and the server. It is necessary to verify the identity of machines and persons who will submit packets.
DMZ Policy
Email servers, databases, web servers, and other systems that require public internet connectivity must be placed on a distinct subnet from the rest of the network. This is to avoid possible black hat attacks, as public domains are easily accessible. The basic purpose of network security is to secure the confidentiality, availability, and integrity of all assets within the network’s perimeter. As a result, the remainder of this article will focus on network security policy components, provide a general description, and lastly demonstrate how to monitor network security by outlining some simple techniques for doing so.
What Belongs in a Network Security Policy?
After performing an extensive analysis, every organisation is expected to design a policy based on many aspects. However, the strategy is susceptible to revisions and alterations when new technologies arise and other sophisticated technologies become economically viable. The following elements may be found in a good policy. Who funds and authorises the policy, as well as those who it directly affects, should be included in the scope and statement of authority.
Access policy – specifies the types of access that management, network operations, and users are allowed to have. It also lays out unique privileges and obligations for different types of network users. Modifying software, adjusting OS settings, adding software to systems, and, most importantly, bringing in new devices to a network should all be covered by the policies stated. Access policy may be incorporated into network policy in significant ways. Acceptable use policy – spells forth what users should do and what technology they should use, such as cell phones, pagers, laptops, and so on. A wireless access policy specifies the conditions under which a wireless device may be utilised on a company network. Password policy – specifies how passwords should appear and how often they should be changed. Authentication policy is a type of advanced password policy that specifies local access password policies as well as distant authentication directives. The availability statement specifies what consumers can expect in terms of resource availability. It should include a list of known dangers, concerns with recovery, and redundancy. It’s also a good idea to include contact details for reporting network or system problems. Security policy for switches and routers – describes how routers and switches connected to a production network should be configured. Antivirus policy – specifies which tools should be utilised and how they should be used.
The extent to which external and internal people are allowed to handle and access the company’s technology is defined by the network and IT systems maintenance policy. The policy should specify whether and under what conditions remote technology maintenance is permitted. It should also explain whether outsourcing is possible, how it is managed, and the legal steps to take if it is. Transgressions reporting policy – classifies violations according to whether or not they should be reported, as well as the person to whom they should be reported. The policy should include rules for dealing with external security incidents, as well as the person who will respond to the incident and the response mechanism that will be used depending on the point of contact.
Example of an Outline for Network Security Policy
Policy on Wireless Communication
Purpose This company does not allow unsecured wireless connection to get access to a network. Only systems having an exclusive waiver or that meet the policy’s requirements will be permitted to join to a network. Scope Every device linked to an internal network is covered by the policy. This includes any wireless communication devices that can send and receive packet data. Policy To comply with this regulation, every wireless implementation must do the following:
Maintain a MAC address, which is a recorded and traceable hardware address. Maintain a minimum of 56-bit point-to-point hardware encryption. Support strong user authentication using external databases like RADIUS, TACAS+, or something similar.
Enforcement Any employee who violates these policies will face disciplinary action, which might include termination.
Definitions Terms Definitions User authentication – should include a technique for confirming that the wireless system is a legitimate user independent of the operating system or computer being utilised. Revision History
The reference would be replaced only by the client or the company. This policy is standardised to make it simple to add unique or complementary policies to the organisation. Monitoring Network Security Policy A criterion for network monitoring as a routine activity should be included in a complete network security policy. The primary goal of network monitoring is to identify areas of vulnerability that could be exploited by hackers. Network monitoring should be implemented primarily to guarantee that network users follow the policies. The monitoring procedure might be as easy as gathering and reviewing log files created by the network when it is running normally. Several failed login attempts could indicate that an individual (user) requires additional training or that a malicious break-in attempt is underway. At the further end of the spectrum, sophisticated augmented systems monitor network traffic. Devices like IDS are used to keep an eye out for red flags like signatures that indicate something is wrong. When the IDS sensor detects a red flag, it alerts the IDS director management console, which starts the mitigation procedure to prevent the attack. Creating a list in a firewall or router to restrict contact from that source is one kind of mitigation.
Conclusion
Network security policies revolve around safeguarding all network resources, from threats to further exploitation. All necessary network devices, transmitted data, and transmission mediums should be covered by the policy. You should have a good understanding of the many policy features needed to enforce regulations for a dependable, secure, and robust network architecture by the end of this article. To increase its performance and defend against potential network vulnerabilities, an organisation should create its policy to be compliant with all of its entities. Your network policy should be robust enough to safeguard your system against a variety of threats, including code injection, software defects, and malware.
